IP core protection using voltage-controlled side-channel receivers

Samarin, Peter; Lemke‐Rust, Kerstin; Paar, Christof

doi:10.1109/hst.2016.7495585

Cited by 3 publications

(2 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, the same phenomenon can be exploited to watermark circuits [5,27], or introduce a no-contact debugging mechanism, for instance to detect stuck signals, without altering routing.…”

Section: Motivationmentioning

confidence: 99%

“…Research on side-and covert-channels on FPGAs and other embedded devices has primarily focused on communications between the device and the outside world. Techniques include varying the power consumption of a device and measuring the impulse response [37], changing how much Electromagnetic Interference is emitted by the device [3], or, in the other direction of communication, measuring voltage [27] and temperature changes [31]. These side-channels can be employed in the context of creating Hardware Trojans (HTs) [19], or as ways to watermark circuits and offer IP protection [5,27].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Leaky Wires: Information Leakage and Covert Communication Between FPGA Long Wires

Giechaskiel,

Rasmussen,

Eguro

2016

Preprint

View full text Add to dashboard Cite

Field-Programmable Gate Arrays (FPGAs) are integrated circuits that implement reconfigurable hardware. They are used in modern systems, creating specialized, highly-optimized integrated circuits without the need to design and manufacture dedicated chips. As the capacity of FPGAs grows, it is increasingly common for designers to incorporate implementations of algorithms and protocols from a range of third-party sources. The monolithic nature of FPGAs means that all on-chip circuits, including third party black-box designs, must share common on-chip infrastructure, such as routing resources. In this paper, we observe that a "long" routing wire carrying a logical 1 reduces the propagation delay of other adjacent but unconnected long wires in the FPGA interconnect, thereby leaking information about its state. We exploit this effect and propose a communication channel that can be used for both covert transmissions between circuits, and for exfiltration of secrets from the chip. We show that the effect is measurable for both static and dynamic signals, and that it can be detected using very small on-board circuits. In our prototype, we are able to correctly infer the logical state of an adjacent long wire over 99% of the time, even without error correction, and for signals that are maintained for as little as 82us. Using a Manchester encoding scheme, our channel bandwidth is as high as 6kbps. We characterize the channel in detail and show that it is measurable even when multiple competing circuits are present and can be replicated on different generations and families of Xilinx devices (Virtex 5, Virtex 6, and Artix 7). Finally, we propose countermeasures that can be deployed by systems and tools designers to reduce the impact of this information leakage.

show abstract

“…Finally, the same phenomenon can be exploited to watermark circuits [5,27], or introduce a no-contact debugging mechanism, for instance to detect stuck signals, without altering routing.…”

Section: Motivationmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Leaky Wires: Information Leakage and Covert Communication Between FPGA Long Wires

Giechaskiel,

Rasmussen,

Eguro

2016

Preprint

View full text Add to dashboard Cite

show abstract

Leaky Wires

Giechaskiel

Rasmussen

Eguro

2018

Proceedings of the 2018 on Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Leakier Wires

Giechaskiel

Eguro

Rasmussen

2019

ACM Trans. Reconfigurable Technol. Syst.

View full text Add to dashboard Cite

In complex FPGA designs, implementations of algorithms and protocols from third-party sources are common. However, the monolithic nature of FPGAs means that all sub-circuits share common on-chip infrastructure, such as routing resources. This presents an attack vector for all FPGAs that contain designs from multiple vendors, especially for FPGAs used in multi-tenant cloud environments, or integrated into multi-core processors. In this article, we show that “long” routing wires present a new source of information leakage on FPGAs, by influencing the delay of adjacent long wires. We show that the effect is measurable for both static and dynamic signals and that it can be detected using small on-board circuits. We characterize the channel in detail and show that it is measurable even when multiple competing circuits (including multiple long-wire transmitters) are present and can be replicated on different generations and families of Xilinx devices (Virtex 5, Virtex 6, Artix 7, and Spartan 7). We exploit the leakage to create a covert channel with 6kbps of bandwidth and 99.9% accuracy, and a side channel, which can recover signals kept constant for only 1.3sμs, with an accuracy of more than 98.4%. Finally, we propose countermeasures to reduce the impact of this leakage. 1

show abstract

IP core protection using voltage-controlled side-channel receivers

Cited by 3 publications

References 11 publications

Leaky Wires: Information Leakage and Covert Communication Between FPGA Long Wires

Leaky Wires: Information Leakage and Covert Communication Between FPGA Long Wires

Leaky Wires

Leakier Wires

Contact Info

Product

Resources

About